This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(76.8, 22%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EW%3C/text%3E%3C/svg%3E)
I recently got ADFS set up on a new web app which is often used on shared computers. The app does not have a way to log out unless the cookie is deleted in the browser. In theory, it seems that if Persistent SSO is disabled, then the cookies that are set should be per-session and thus go away when the browser closes. Even more, it seems the "Keep me signed in" button should be able to control this when users sign in. However, it doesn't seem to work. When I sign in with the button unchecked OR if I sign in when Persistent SSO is disabled entirely, the cookie that is set expires on 12 December 2020 (looks like 2,000,000 seconds??), not Session. Ideally I'd want to have the "Keep me signed in" button control whether the cookie was persistent (which I believe is 90 days as long as one logs in every 14 days) or session.
ADFS SSO cookies are not persistent by default but If the application give you persistant cookies, and if the application doesn't have a way to destroy its own cookies, I'm afraid we are kind of stucked.
If you are not sure why the session seems persistent (my guess is that the app has a persistance), then you can share a Fiddler trace here and we'll look into it.
I have never used Fiddler before, but I gave it a shot. It doesn't look like I can attach the .saz file here, do you have somewhere I can upload it to share?
You can store it on OneDrive or DropBox and share the link here.
In your trace, the MSISAuth is a session cookie (the cookie used for ADFS SSO). We can see it does not have a expiration date (and as per RFC, cookies without expiration date will be destroy once the browser is closed).
But the application is setting a persistant cookie (used to access the app):
Set-Cookie: SSESScf18854deaf948166acebeb4d2283bb3=<redacted>; expires=Fri, 08-Jan-2021 00:24:40 GMT; Max-Age=2000000; path=/; domain=.<redacted>; secure; HttpOnly
This cookie will stay on the disk until the Fri, 08-Jan-2021 00:24:40 GMT. The application developper need to modify the code and implement a sign-out mechanism.
Ok, so this is an application issue. Why does the "Keep Me Signed In" button not seem to change the behavior? Is it up to the app to handle that?
Correct. An application issue. The app has to handle the cookie deletion. And that's a requirement as per the HTTP specification. Only a server in the cookie namespace can create, update and delete cookies. ADFS cannot touch the cookies of the app.
The Keep Me Signed In button is an ADFS feature. Not an application feature. The app is agnostic of this setting.
Ok, thank you. When would the button apply then, if the cookies are handled entirely by the app?
KMSI is doing only one thing. It is making your ADFS SSO cookie (the MSISSAuth) persistent instead of a session cookie.
What the application needs to implement is a proper SAML log out. The user would click on the link, it woud redirect the user to ADFS with a <samlp:LogoutRequest> message. ADFS would then contact the all the apps you logged in within your SSO session, they will destroy their cookies. ADFS will then procede and destroy the user ADFS SSO cookies (persistant or not) and then redirect to the initial app for it to also destroy its SOO cookies.
There is unfortunaly nothing we can do at the ADFS level for now.